CRITICALCWE-838
PARSE-008 Nested Encoding Chain Attack
Parser Differential: Exploits differences in how parsers (JSON, YAML, markdown) interpret the same input to bypass security controls
Description
Chains multiple encoding layers (base64 inside URL encoding inside HTML entities) so each parser layer strips one encoding, revealing the attack payload
Remediation
Limit decode depth to 1 level. Reject inputs with nested encodings. Apply security filters after all decoding is complete, never between decode stages.